@arkade-os/sdk 0.4.59 → 0.4.61

package/dist/index.d.ts

@@ -1,11 +1,11 @@
-import { a2 as ReadonlyIdentity, a as Identity, am as DescriptorSigningRequest, an as Transaction, ai as SignerSession, a0 as DescriptorProvider, x as IntentRepository, y as ArkIntent, z as IntentFilter, O as Outpoint, B as VirtualTxRepository, D as VirtualTx, F as VtxoBranch, W as WalletRepository, t as ExtendedVirtualCoin, u as VtxoRepositoryKey, E as ExtendedCoin, A as ArkTransaction, v as WalletState, s as Contract, C as ContractRepository, w as ContractFilter, ao as IntentFeeConfig, ap as OffchainInput, aq as FeeAmount, ar as OnchainInput, as as FeeOutput, n as ArkProvider, ag as SettlementConfig, at as ContractWatcherConfig, au as Asset, R as Recipient, I as IWallet, av as FeeInfo, i as SettlementEvent, h as SettleParams, S as SendBitcoinParams, G as GetVtxosFilter, aw as CreateContractParams, ax as GetContractsFilter, r as VirtualCoin, ay as GetSpendablePathsOptions, az as GetAllSpendingPathsOptions, aA as IssuanceParams, aB as ReissuanceParams, aC as BurnParams, aD as RenewVtxosOptions, c as WalletBalance, a9 as ContractSyncState, aE as ContractWithVtxos, aF as PathSelection, aG as ContractEvent, aH as AssetDetails, aI as IssuanceResult, aJ as DelegateInfo, aK as MigrationGlobalSkipReason, aL as MigrationLegSkipReason, aM as SignerStatus, a1 as IReadonlyWallet, d as ActivityRegistry, a8 as IReadonlyAssetManager, aN as StorageConfig, e as Activity, N as NormalizedExtendedVirtualCoin, f as IContractManager, j as IAssetManager, g as IDelegateManager, aO as IVtxoManager, a3 as OnchainProvider, J as Network, aa as NetworkName, ad as Coin, aP as ExplorerTransaction, q as TapLeafScript, aQ as EncodedVtxoScript, K as CSVMultisigTapscript, p as RelativeTimelock, V as VtxoScript, aR as Status, ac as ArkAddress, ak as Intent, aS as ChainTx, o as IndexerProvider, Q as TxTree, aT as PathContext } from './ark-C9DsPSm8.js';
-export { aU as ActivityIntent, aV as ActivityResolver, ab as ArkInfo, aW as ArkIntentState, aX as ArkTapscript, aY as AssetMetadata, aZ as BITCOIN_EMULATOR_PUBKEY, a_ as BaseWalletConfig, Z as BatchFailedEvent, X as BatchFinalizationEvent, Y as BatchFinalizedEvent, a$ as BatchInfo, b0 as BatchSignableIdentity, M as BatchStartedEvent, b1 as CLTVMultisigTapscript, b2 as CandidateDeps, b3 as ChainTxType, H as ChainedTxType, b4 as CommitmentTx, b5 as ConditionCSVMultisigTapscript, b6 as ConditionMultisigTapscript, b7 as ContractBalance, b8 as ContractEventCallback, b9 as ContractHandler, ae as ContractManager, af as ContractManagerConfig, ba as ContractState, bb as ContractVtxo, bc as ContractWatcher, bd as DelegateManagerImpl, be as DelegateOptions, a4 as DelegateProvider, bf as DelegatorManagerImpl, bg as DelegatorProvider, bh as DeprecatedSignerMigrationReport, bi as DeprecatedSignerReport, bj as DigestMismatchError, bk as Discoverable, bl as DiscoveredContract, bm as DiscoveryDeps, bn as ESPLORA_URL, bo as EsploraProvider, a6 as ExitCaptureMode, bp as ExitChainResolver, a7 as ExitDataSource, bq as ExtendedContractVtxo, br as GroupMembership, bs as HandlerError, bt as IDelegatorManager, bu as INTENT_TERMINAL_STATES, bv as IndexerTxType, bw as KnownMetadata, bx as MUTINYNET_EMULATOR_PUBKEY, by as MigrateDeprecatedSignerOptions, bz as MigrationLegReport, bA as MigrationVtxoRef, bB as MultisigTapscript, bC as Nonces, bD as Output, bE as PageResponse, bF as PaginationOptions, bG as PartialSig, bH as ProviderClass, bI as REGTEST_EMULATOR_PUBKEY, a5 as ReadonlyWalletConfig, k as RestArkProvider, bJ as RestDelegateProvider, bK as RestDelegatorProvider, l as RestIndexerProvider, bL as ScanContractsOptions, bM as ScanResult, bN as ScheduledSession, bO as SettlementEventType, bP as SignRequest, aj as SignedIntent, bQ as SignerClassification, L as SignerSet, bR as SubscriptionEvent, bS as SubscriptionHeartbeat, m as SubscriptionResponse, bT as TapLeaves, bU as TapTreeCoder, bV as TapscriptType, al as TimeHeight, bW as TreeNonces, U as TreeNoncesEvent, bX as TreePartialSigs, $ as TreeSignatureEvent, P as TreeSigningStartedEvent, _ as TreeTxEvent, bY as Tx, bZ as TxHistoryRecord, b_ as TxKey, T as TxNotification, b$ as TxTag, c0 as TxTreeNode, c1 as TxType, c2 as VirtualStatus, c3 as Vtxo, c4 as VtxoChain, ah as VtxoManager, c5 as VtxoType, b as WalletConfig, c6 as WalletMode, c7 as assetMintResolver, c8 as boardingResolver, c9 as canRecoverOnchain, ca as canSpendOffchain, cb as classifyAgainstSignerSet, cc as classifyContractSigner, cd as collabExitResolver, ce as createDefaultActivityRegistry, cf as createExitChainResolver, cg as decodeTapscript, ch as defaultEmulatorPubkey, ci as getNetwork, cj as getSequence, ck as hasCandidates, cl as hasTerminalSpend, cm as isBatchSignable, cn as isCooperativelyMigratable, co as isDiscoverable, cp as isExpired, cq as isPastExpiry, cr as isRecoverable, cs as isSpendable, ct as isSubdust, cu as isTerminalIntentState, cv as isVirtualCoin, cw as isVtxoExpiringSoon, cx as networks, cy as resolveEmulatorPubkey, cz as scriptFromTapLeafScript, cA as signerSetFromInfo, cB as toXOnlySignerHex } from './ark-C9DsPSm8.js';
-import { W as Wallet, R as ReadonlyWallet, a as ReceiveRotatorFactory, b as ReceiveRotatorBootOpts, c as ReceiveRotatorBoot, P as ProviderConnectionState, B as BatchExpiryPolicy, d as Batch } from './wallet-EyVDhqzP.js';
-export { A as ArkError, e as ArkErrorName, f as ArkadeCashClaimResult, g as ArkadeCashCreateError, h as ArkadeCashUnclaimedReason, i as ArkadeCashUnclaimedVtxo, j as BoardingUtxoGroup, C as CheckpointExitDelayPolicy, D as DEFAULT_MIN_BATCH_EXPIRY_SECONDS, k as DEFAULT_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, H as HDWalletCapable, I as IncomingFunds, M as MUTINYNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, l as ProviderKind, m as ProviderUnavailableError, n as REGTEST_MIN_BATCH_EXPIRY_SECONDS, o as REGTEST_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, S as SIGNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, p as ServerInfoSource, q as ServerResponseMismatchError, r as assertValidBatchExpiry, s as assertValidServerUnrollScript, t as defaultBatchExpiryPolicy, u as defaultCheckpointExitDelayPolicy, v as getRandomId, w as isArkError, x as isHDWalletCapable, y as maybeArkError, z as resolveBatchExpiryPolicy, E as resolveCheckpointExitDelayPolicy, F as selectVirtualCoins, G as waitForIncomingFunds } from './wallet-EyVDhqzP.js';
-import { P as Program, A as ArkadeParamValue, a as ArkadeProgramScript, b as ProgramKeys, c as ArkadeArgValue, C as CompiledProgramFunction, d as ArkadeFunction, I as InputRef, e as InputDef, f as ArkadeValueType, g as ArkadeArgType, h as ArkadeContractParams, i as ArkadeSegment, j as AsmToken, S as SUPPORTED_PROGRAM_VERSION, k as SignerRef, T as TapscriptSegment, W as WitnessRef, l as deserializeArkadeContractParams, p as parseArtifact, r as resolveAsm, s as serializeArkadeContractParams, m as stringifyArtifact, v as validateProgram, w as witnessRefToBytes } from './index-BmK6tEqf.js';
-export { n as ArkadeContractHandler, B as BoardingContractHandler, o as BoardingContractParams, D as DefaultContractHandler, q as DefaultContractParams, t as DelegateContractHandler, u as DelegateContractParams, V as VHTLC, x as VHTLCContractHandler, y as VHTLCContractParams, z as contractHandlers } from './index-BmK6tEqf.js';
-import { D as DefaultVtxo } from './delegate-B_oKWm1k.js';
-export { a as DelegateVtxo } from './delegate-B_oKWm1k.js';
+import { a1 as ReadonlyIdentity, a as Identity, ao as DescriptorSigningRequest, ap as Transaction, ak as SignerSession, J as DescriptorProvider, aq as IntentFeeConfig, ar as OffchainInput, as as FeeAmount, at as OnchainInput, au as FeeOutput, x as IntentRepository, y as ArkIntent, z as IntentFilter, O as Outpoint, B as VirtualTxRepository, D as VirtualTx, F as VtxoBranch, W as WalletRepository, t as ExtendedVirtualCoin, u as VtxoRepositoryKey, E as ExtendedCoin, A as ArkTransaction, v as WalletState, s as Contract, C as ContractRepository, w as ContractFilter, I as IWallet, n as ArkProvider, ai as SettlementConfig, av as ContractWatcherConfig, aw as Asset, R as Recipient, ax as FeeInfo, i as SettlementEvent, h as SettleParams, S as SendBitcoinParams, G as GetVtxosFilter, ay as CreateContractParams, az as GetContractsFilter, r as VirtualCoin, aA as GetSpendablePathsOptions, aB as GetAllSpendingPathsOptions, aC as IssuanceParams, aD as ReissuanceParams, aE as BurnParams, aF as RenewVtxosOptions, c as WalletBalance, a8 as ContractSyncState, ad as ContractWithVtxos, aG as PathSelection, aH as ContractEvent, aI as AssetDetails, aJ as IssuanceResult, aK as DelegateInfo, aL as MigrationGlobalSkipReason, aM as MigrationLegSkipReason, aN as SignerStatus, a0 as IReadonlyWallet, d as ActivityRegistry, a7 as IReadonlyAssetManager, aO as StorageConfig, e as Activity, N as NormalizedExtendedVirtualCoin, f as IContractManager, j as IAssetManager, g as IDelegateManager, aP as IVtxoManager, a2 as OnchainProvider, K as Network, aa as NetworkName, af as Coin, aQ as ExplorerTransaction, q as TapLeafScript, aR as EncodedVtxoScript, L as CSVMultisigTapscript, p as RelativeTimelock, V as VtxoScript, aS as Status, ac as ArkAddress, am as Intent, aT as ChainTx, o as IndexerProvider, Q as TxTree, aU as PathContext } from './index-BcRCHnzN.js';
+export { aV as ActivityIntent, aW as ActivityResolver, ab as ArkInfo, aX as ArkIntentState, aY as ArkTapscript, aZ as AssetMetadata, a_ as BITCOIN_EMULATOR_PUBKEY, a$ as BaseWalletConfig, Z as BatchFailedEvent, X as BatchFinalizationEvent, Y as BatchFinalizedEvent, b0 as BatchInfo, b1 as BatchSignableIdentity, M as BatchStartedEvent, b2 as CLTVMultisigTapscript, b3 as CandidateDeps, b4 as ChainTxType, H as ChainedTxType, b5 as CommitmentTx, b6 as ConditionCSVMultisigTapscript, b7 as ConditionMultisigTapscript, b8 as ContractBalance, b9 as ContractEventCallback, ba as ContractHandler, ag as ContractManager, ah as ContractManagerConfig, bb as ContractState, bc as ContractVtxo, bd as ContractWatcher, be as DelegateManagerImpl, bf as DelegateOptions, a3 as DelegateProvider, bg as DelegatorManagerImpl, bh as DelegatorProvider, bi as DeprecatedSignerMigrationReport, bj as DeprecatedSignerReport, bk as DigestMismatchError, bl as Discoverable, bm as DiscoveredContract, bn as DiscoveryDeps, bo as ESPLORA_URL, bp as EsploraProvider, bq as EventSourceCapable, br as EventSourceFactory, bs as EventSourceLike, bt as EventSourceUnavailableError, a5 as ExitCaptureMode, bu as ExitChainResolver, a6 as ExitDataSource, bv as ExtendedContractVtxo, bw as GroupMembership, bx as HandlerError, by as IDelegatorManager, bz as INTENT_TERMINAL_STATES, bA as IndexerTxType, bB as KnownMetadata, bC as MUTINYNET_EMULATOR_PUBKEY, bD as MigrateDeprecatedSignerOptions, bE as MigrationLegReport, bF as MigrationVtxoRef, bG as MultisigTapscript, bH as Nonces, bI as Output, bJ as PageResponse, bK as PaginationOptions, bL as PartialSig, bM as ProviderClass, bN as REGTEST_EMULATOR_PUBKEY, a4 as ReadonlyWalletConfig, k as RestArkProvider, bO as RestDelegateProvider, bP as RestDelegatorProvider, l as RestIndexerProvider, bQ as ScanContractsOptions, bR as ScanResult, bS as ScheduledSession, bT as SettlementEventType, bU as SignRequest, al as SignedIntent, bV as SignerClassification, bW as SignerSet, bX as SubscriptionEvent, bY as SubscriptionHeartbeat, m as SubscriptionResponse, bZ as TapLeaves, b_ as TapTreeCoder, b$ as TapscriptType, an as TimeHeight, c0 as TreeNonces, U as TreeNoncesEvent, c1 as TreePartialSigs, $ as TreeSignatureEvent, P as TreeSigningStartedEvent, _ as TreeTxEvent, c2 as Tx, c3 as TxHistoryRecord, c4 as TxKey, T as TxNotification, c5 as TxTag, c6 as TxTreeNode, c7 as TxType, c8 as VirtualStatus, c9 as Vtxo, ca as VtxoChain, aj as VtxoManager, cb as VtxoType, b as WalletConfig, cc as WalletMode, cd as assetMintResolver, ce as boardingResolver, cf as canRecoverOnchain, cg as canSpendOffchain, ch as classifyAgainstSignerSet, ci as classifyContractSigner, cj as collabExitResolver, ck as configureEventSource, cl as createDefaultActivityRegistry, cm as createExitChainResolver, cn as decodeTapscript, co as defaultEmulatorPubkey, cp as getConfiguredEventSource, cq as getNetwork, cr as getRandomId, cs as getSequence, ct as hasCandidates, cu as hasTerminalSpend, cv as isBatchSignable, cw as isCooperativelyMigratable, cx as isDiscoverable, cy as isEventSourceUnavailableError, cz as isExpired, cA as isPastExpiry, cB as isRecoverable, cC as isSigningIdentity, cD as isSpendable, cE as isSubdust, cF as isTerminalIntentState, cG as isVirtualCoin, cH as isVtxoExpiringSoon, cI as networks, cJ as resolveEmulatorPubkey, cK as resolveEventSource, cL as scriptFromTapLeafScript, cM as signerSetFromInfo, cN as toXOnlySignerHex } from './index-BcRCHnzN.js';
+import { W as Wallet, R as ReadonlyWallet, b as ReceiveRotatorFactory, c as ReceiveRotatorBootOpts, d as ReceiveRotatorBoot, P as ProviderConnectionState, H as HDWalletCapable, a as HDAllocationCapable, B as BatchExpiryPolicy, e as Batch } from './wallet-BVIfg2ic.js';
+export { A as ArkError, f as ArkErrorName, g as ArkadeCashClaimResult, h as ArkadeCashCreateError, i as ArkadeCashUnclaimedReason, j as ArkadeCashUnclaimedVtxo, k as BoardingUtxoGroup, C as CheckpointExitDelayPolicy, D as DEFAULT_MIN_BATCH_EXPIRY_SECONDS, l as DEFAULT_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, F as ForeignDescriptorError, I as IncomingFunds, M as MAX_USED_SIGNING_DESCRIPTORS_LOOK_AHEAD, m as MUTINYNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, n as ProviderKind, o as ProviderUnavailableError, p as REGTEST_MIN_BATCH_EXPIRY_SECONDS, q as REGTEST_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, S as SIGNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, r as ServerInfoSource, s as ServerResponseMismatchError, t as assertValidBatchExpiry, u as assertValidServerUnrollScript, v as defaultBatchExpiryPolicy, w as defaultCheckpointExitDelayPolicy, x as isArkError, y as isHDAllocationCapable, z as isHDWalletCapable, E as maybeArkError, G as resolveBatchExpiryPolicy, J as resolveCheckpointExitDelayPolicy, K as resolveDescriptorSigner, L as selectVirtualCoins, N as signingDescriptorIndex, O as strictSigningDescriptorIndex, Q as waitForIncomingFunds } from './wallet-BVIfg2ic.js';
+import { P as Program, A as ArkadeParamValue, a as ArkadeProgramScript, b as ProgramKeys, c as ArkadeArgValue, C as CompiledProgramFunction, d as ArkadeFunction, I as InputRef, e as InputDef, f as ArkadeValueType, g as ArkadeArgType, h as ArkadeContractParams, i as ArkadeSegment, j as AsmToken, S as SUPPORTED_PROGRAM_VERSION, k as SignerRef, T as TapscriptSegment, W as WitnessRef, l as deserializeArkadeContractParams, p as parseArtifact, r as resolveAsm, s as serializeArkadeContractParams, m as stringifyArtifact, v as validateProgram, w as witnessRefToBytes } from './index-C29VNcxC.js';
+export { n as ArkadeContractHandler, B as BoardingContractHandler, o as BoardingContractParams, D as DefaultContractHandler, q as DefaultContractParams, t as DelegateContractHandler, u as DelegateContractParams, V as VHTLC, x as VHTLCContractHandler, y as VHTLCContractParams, z as VHTLCV2ContractHandler, E as VHTLCV2ContractParams, F as contractHandlers } from './index-C29VNcxC.js';
+import { D as DefaultVtxo } from './delegate-BySzD37I.js';
+export { a as DelegateVtxo } from './delegate-BySzD37I.js';
 import { Bytes, BTC_NETWORK } from '@scure/btc-signer/utils.js';
 import { P2TR } from '@scure/btc-signer/payment.js';
 import { Transaction as Transaction$1, OP, Script, ScriptType } from '@scure/btc-signer';
@@ -363,6 +363,21 @@ declare class ReadonlyDescriptorIdentity implements ReadonlyHDCapableIdentity {
     isOurs(descriptor: string): boolean;
 }
 
+/**
+ * Normalize a value to descriptor format.
+ * If already a descriptor, return as-is. If hex pubkey, wrap as tr(pubkey).
+ * Throws when the value is empty or not a string so we never produce
+ * malformed descriptors like `tr()` that downstream parsers would reject.
+ */
+declare function normalizeToDescriptor(value: string): string;
+/**
+ * Extract the x-only (32-byte) pubkey from a materialized descriptor.
+ * Handles both static `tr(pubkey)` and materialized HD
+ * `tr([fp/..]xpub/0/<i>)` shapes via the descriptors-scure expansion map.
+ * Throws a plain Error when the descriptor is non-rangeable / unparseable;
+ * callers that need a typed error wrap this.
+ */
+declare function deriveDescriptorLeafPubKey(descriptor: string): Uint8Array;
 /**
  * Compressed (33-byte) counterpart of {@link deriveDescriptorLeafPubKey}, for
  * protocols that key on the parity byte (Boltz swap keys).
@@ -371,6 +386,33 @@ declare class ReadonlyDescriptorIdentity implements ReadonlyHDCapableIdentity {
  * synthesizing `02||xonly` would silently produce the wrong key half the time.
  */
 declare function deriveDescriptorLeafCompressedPubKey(descriptor: string): Uint8Array;
+/** Parsed HD descriptor components. */
+interface ParsedHDDescriptor {
+    fingerprint: string;
+    basePath: string;
+    xpub: string;
+    derivationPath: string;
+}
+/**
+ * Parse an HD descriptor into its components.
+ * HD descriptors have the format: tr([fingerprint/path']xpub/derivation)
+ * Returns null if the descriptor is not in HD format.
+ */
+declare function parseHDDescriptor(descriptor: string): ParsedHDDescriptor | null;
+/**
+ * The descriptor that names an identity's own key: the whole of a static
+ * wallet's key policy, and the descriptor a record bound before an `auto`
+ * wallet became HD carries.
+ *
+ * One spelling, deliberately. Every site that mints this must produce
+ * byte-identical output for one identity, or a stored descriptor stops
+ * round-tripping through `signerForDescriptor` and `contractSigner`'s
+ * pubkey-equality check — a record the wallet can sign for, refused as
+ * foreign.
+ */
+declare function identityDescriptor(identity: {
+    xOnlyPublicKey(): Promise<Uint8Array>;
+}): Promise<string>;
 
 /**
  * Descriptor-scoped signing surface — the two members every
@@ -494,6 +536,55 @@ declare class ReadonlySingleKey implements ReadonlyIdentity {
     compressedPublicKey(): Promise<Uint8Array>;
 }
 
+/**
+ * Estimator evaluates CEL expressions to calculate fees for Arkade intents
+ */
+declare class Estimator {
+    readonly config: IntentFeeConfig;
+    private intentOffchainInput?;
+    private intentOnchainInput?;
+    private intentOffchainOutput?;
+    private intentOnchainOutput?;
+    /**
+     * Creates a new Estimator with the given config
+     * @param config - Configuration containing CEL programs for fee calculation
+     */
+    constructor(config: IntentFeeConfig);
+    /**
+     * Evaluates the fee for a given vtxo input
+     * @param input - The offchain input to evaluate
+     * @returns The fee amount for this input
+     */
+    evalOffchainInput(input: OffchainInput): FeeAmount;
+    /**
+     * Evaluates the fee for a given boarding input
+     * @param input - The onchain input to evaluate
+     * @returns The fee amount for this input
+     */
+    evalOnchainInput(input: OnchainInput): FeeAmount;
+    /**
+     * Evaluates the fee for a given vtxo output
+     * @param output - The output to evaluate
+     * @returns The fee amount for this output
+     */
+    evalOffchainOutput(output: FeeOutput): FeeAmount;
+    /**
+     * Evaluates the fee for a given collaborative exit output
+     * @param output - The output to evaluate
+     * @returns The fee amount for this output
+     */
+    evalOnchainOutput(output: FeeOutput): FeeAmount;
+    /**
+     * Evaluates the fee for a given set of inputs and outputs
+     * @param offchainInputs - Array of offchain inputs to evaluate
+     * @param onchainInputs - Array of onchain inputs to evaluate
+     * @param offchainOutputs - Array of offchain outputs to evaluate
+     * @param onchainOutputs - Array of onchain outputs to evaluate
+     * @returns The total fee amount
+     */
+    evaluate(offchainInputs: OffchainInput[], onchainInputs: OnchainInput[], offchainOutputs: FeeOutput[], onchainOutputs: FeeOutput[]): FeeAmount;
+}
+
 declare class InMemoryIntentRepository implements IntentRepository {
     readonly version: 1;
     private byId;
@@ -589,6 +680,73 @@ declare class InMemoryWalletRepository implements WalletRepository {
     [Symbol.asyncDispose](): Promise<void>;
 }
 
+/**
+ * Whether generic wallet spending may select this contract's VTXOs.
+ *
+ * Default closed: a type whose handler declares nothing — a custom type, a
+ * plugin type, a row whose handler is not registered in this context — is not
+ * spendable. Every shipped handler answers explicitly.
+ *
+ * @see ContractHandler.isGenericallySpendable
+ */
+declare function isContractGenericallySpendable(contract: Contract): boolean;
+/**
+ * The contracts generic spending must skip, as `script → type`. VTXOs are keyed
+ * to their contract by `script`, so membership answers the per-VTXO question too.
+ */
+declare function gatedContracts(contracts: readonly Contract[]): Map<string, string>;
+/** The minimum a VTXO must carry to be matched against an exclusion set. */
+type ExcludableVtxo = {
+    txid: string;
+    vout: number;
+    script?: string;
+};
+/**
+ * Why generic spending skips a VTXO, or `undefined` when it does not — phrased
+ * to follow the outpoint in a log line.
+ *
+ * Generic spending applies three exclusions (the contract gate, pending
+ * recovery, intent locks) that key on different things — script, script,
+ * outpoint. Stating each as a reason-or-undefined lets all three report through
+ * one path, so no exclusion can drop a coin silently while another logs.
+ */
+type VtxoExclusion = (vtxo: ExcludableVtxo) => string | undefined;
+/** The contract gate as an exclusion, naming the type that closed it. */
+declare function gateExclusion(gated: ReadonlyMap<string, string>): VtxoExclusion;
+/** Outpoints excluded for a shared reason, e.g. an intent-lock set. */
+declare function outpointExclusion(outpoints: ReadonlySet<string>, reason: string): VtxoExclusion;
+/**
+ * Outpoints excluded for individually-named reasons — a per-input timelock,
+ * where one shared reason would be wrong because the inputs differ.
+ *
+ * Unlike {@link gateExclusion}, the reasons are the handlers' own sentences and
+ * are not rephrased to follow the outpoint: that text is what tells the reader
+ * when to retry, and a paraphrase here would be a second spelling to keep in
+ * step with it.
+ *
+ * @see outpointExclusion for the shared-reason form.
+ */
+declare function outpointReasons(reasons: ReadonlyMap<string, string>): VtxoExclusion;
+/**
+ * Report VTXOs an exclusion dropped — the only field-diagnosable signal for why
+ * a coin is missing from a spend, or why an explicitly named one will fail.
+ * Debug level, one line per VTXO per reason.
+ */
+declare function logExcludedVtxos(source: string, vtxos: readonly ExcludableVtxo[], exclusions: readonly VtxoExclusion[]): void;
+/**
+ * Thrown when a spend names VTXOs whose contract can no longer be annotated —
+ * its handler is not registered here, its handler rejects the stored params, or
+ * it has no contract row at all.
+ *
+ * Raised before submission on purpose. Spending reads the tapscripts stored on
+ * each coin rather than re-deriving them, so such a spend would otherwise build
+ * and broadcast normally and only fail in the bookkeeping afterwards, leaving
+ * the transaction on the network and the local state behind it.
+ */
+declare class UnannotatableInputError extends Error {
+    readonly name = "UnannotatableInputError";
+}
+
 /**
  * Encode a contract to the arkcontract string format.
  *
@@ -688,12 +846,35 @@ declare function contractFromArkContractWithAddress(encoded: string, serverPubKe
  */
 declare function isArkContract(str: string): boolean;
 
+/**
+ * Thrown when a descriptor-capable contract (default, delegate, or boarding)
+ * cannot be routed to any signer: its owner key (`params.pubKey`) is not this
+ * wallet's baseline signing key, and the record carries no
+ * `metadata.signingDescriptor` to send it to a descriptor-aware signer.
+ *
+ * Note that this can arise also when a contract belongs to a different identity (storage reuse).
+ */
+declare class MissingSigningDescriptorError extends Error {
+    readonly contractScript: string;
+    readonly contractType: "default" | "delegate" | "boarding";
+    readonly name = "MissingSigningDescriptorError";
+    constructor(contractScript: string, contractType: "default" | "delegate" | "boarding");
+}
+/**
+ * Thrown when an input needs descriptor-aware signing but no
+ * DescriptorProvider was wired into the wallet.
+ */
+declare class DescriptorSigningProviderMissingError extends Error {
+    readonly name = "DescriptorSigningProviderMissingError";
+    constructor();
+}
+
 /**
  * In-memory implementation of ContractRepository.
  * Data is ephemeral and scoped to the instance.
  */
 declare class InMemoryContractRepository implements ContractRepository {
-    readonly version: 1;
+    readonly version: 2;
     private readonly contractData;
     private readonly collections;
     private readonly contractsByScript;
@@ -711,7 +892,7 @@ declare class InMemoryContractRepository implements ContractRepository {
  */
 declare class IndexedDBContractRepository implements ContractRepository {
     private readonly dbName;
-    readonly version: 1;
+    readonly version: 2;
     private db;
     constructor(dbName?: string);
     clear(): Promise<void>;
@@ -798,9 +979,9 @@ declare class WalletRepositoryImpl implements WalletRepository {
  * @deprecated This is only to be used in migration from storage V1
  */
 declare class ContractRepositoryImpl implements ContractRepository {
-    readonly version: 1;
     private storage;
     constructor(storage: StorageAdapter);
+    get version(): 2;
     getContractData<T>(contractId: string, key: string): Promise<T | null>;
     setContractData<T>(contractId: string, key: string, data: T): Promise<void>;
     deleteContractData(contractId: string, key: string): Promise<void>;
@@ -815,76 +996,145 @@ declare class ContractRepositoryImpl implements ContractRepository {
 }
 
 /**
- * Estimator evaluates CEL expressions to calculate fees for Arkade intents
+ * Domain separator for the preimage derivation.
+ *
+ * Protocol-scoped and versioned, mirroring NArk's `Arkade-Boltz-Preimage-v1`
+ * (`SwapsManagementService.cs:128`), so any Arkade SDK implementing this
+ * scheme reproduces the same preimage and can recover an artifact another
+ * SDK created. Deliberately distinct from the Boltz tag: a shared tag would
+ * make one wallet key derive one preimage for both corridors.
  */
-declare class Estimator {
-    readonly config: IntentFeeConfig;
-    private intentOffchainInput?;
-    private intentOnchainInput?;
-    private intentOffchainOutput?;
-    private intentOnchainOutput?;
-    /**
-     * Creates a new Estimator with the given config
-     * @param config - Configuration containing CEL programs for fee calculation
-     */
-    constructor(config: IntentFeeConfig);
-    /**
-     * Evaluates the fee for a given vtxo input
-     * @param input - The offchain input to evaluate
-     * @returns The fee amount for this input
-     */
-    evalOffchainInput(input: OffchainInput): FeeAmount;
-    /**
-     * Evaluates the fee for a given boarding input
-     * @param input - The onchain input to evaluate
-     * @returns The fee amount for this input
-     */
-    evalOnchainInput(input: OnchainInput): FeeAmount;
-    /**
-     * Evaluates the fee for a given vtxo output
-     * @param output - The output to evaluate
-     * @returns The fee amount for this output
-     */
-    evalOffchainOutput(output: FeeOutput): FeeAmount;
+declare const ARKADE_SWAP_PREIMAGE_TAG = "Arkade-RFQ-Preimage-v1";
+/**
+ * `TAG ‖ xonly(32) ‖ u32le(index)` — the message that gets BIP-340 signed.
+ *
+ * Anchored on the canonical x-only key rather than the descriptor string: a
+ * restore reconstructs a bare descriptor that serialises differently from the
+ * signing descriptor used at creation, and only the key agrees across both.
+ */
+declare function buildPreimageMessage(xonly: Uint8Array, index: number): Uint8Array;
+/**
+ * True iff `descriptor` names one artifact — an HD child. A bare `tr(pubkey)`
+ * is the same key every time it is handed out, so anything deriving
+ * per-artifact secrets must branch on this, never on the wallet's type.
+ */
+declare function isPerArtifactDescriptor(descriptor: string): boolean;
+/** A key the wallet provisioned for a contract we must be able to spend. */
+interface ProvisionedKey {
+    /** x-only pubkey to bind into the covenant. */
+    pubkey: Uint8Array;
     /**
-     * Evaluates the fee for a given collaborative exit output
-     * @param output - The output to evaluate
-     * @returns The fee amount for this output
+     * The wallet descriptor it came from. Public — persist it with the
+     * artifact; {@link contractSigner} resolves it back to a signer.
      */
-    evalOnchainOutput(output: FeeOutput): FeeAmount;
+    descriptor: string;
+}
+/** A claim key together with the preimage it claims with. */
+interface ProvisionedClaimSecret extends ProvisionedKey {
+    preimage: Uint8Array;
+    /** `sha256(preimage)` — what the contract commits to. */
+    paymentHash: Uint8Array;
     /**
-     * Evaluates the fee for a given set of inputs and outputs
-     * @param offchainInputs - Array of offchain inputs to evaluate
-     * @param onchainInputs - Array of onchain inputs to evaluate
-     * @param offchainOutputs - Array of offchain outputs to evaluate
-     * @param onchainOutputs - Array of onchain outputs to evaluate
-     * @returns The total fee amount
+     * Persist `preimage` with the artifact: this wallet cannot re-derive it.
+     * True when the caller supplied P, or when the descriptor is shared across
+     * artifacts. When false the preimage re-derives from the seed and nothing
+     * secret needs to be stored.
      */
-    evaluate(offchainInputs: OffchainInput[], onchainInputs: OnchainInput[], offchainOutputs: FeeOutput[], onchainOutputs: FeeOutput[]): FeeAmount;
+    mustPersistPreimage: boolean;
 }
-
 /**
- * Thrown when a descriptor-capable contract (default, delegate, or boarding)
- * cannot be routed to any signer: its owner key (`params.pubKey`) is not this
- * wallet's baseline signing key, and the record carries no
- * `metadata.signingDescriptor` to send it to a descriptor-aware signer.
+ * The key that spends a leg we fund — the refund key of an HTLC, the user key
+ * of a covenant's cancel path.
  *
- * Note that this can arise also when a contract belongs to a different identity (storage reuse).
+ * The returned `pubkey` is taken from a signer the wallet produced, never
+ * from the descriptor string alone. That is the difference between an
+ * invariant and a comment: deriving the leaf key is pure parsing and would
+ * succeed just as well for a key this wallet cannot sign for — a descriptor
+ * allocated by a worker rebound to another identity, a record restored onto
+ * the wrong seed — and the covenant would bind it, the leg would fund, and
+ * the failure would surface at refund time with the money already committed.
+ * Throws {@link ForeignDescriptorError} instead, before there is a quote.
+ *
+ * On an HD wallet this consumes an index even if the artifact is never built,
+ * and a swap index never becomes a funded receive contract, so a long run of
+ * them widens the gap a seed-only restore scan sees.
  */
-declare class MissingSigningDescriptorError extends Error {
-    readonly contractScript: string;
-    readonly contractType: "default" | "delegate" | "boarding";
-    readonly name = "MissingSigningDescriptorError";
-    constructor(contractScript: string, contractType: "default" | "delegate" | "boarding");
+declare function provisionRefundKey(wallet: IWallet): Promise<ProvisionedKey>;
+/**
+ * The key that spends a leg we claim, plus the preimage that unlocks it.
+ *
+ * Pass `opts.preimage` to bring your own 32-byte P; it comes back verbatim
+ * with `mustPersistPreimage` set, since the wallet cannot re-derive what it
+ * did not choose.
+ */
+declare function provisionClaimSecret(wallet: IWallet, opts?: {
+    preimage?: Uint8Array;
+}): Promise<ProvisionedClaimSecret>;
+/**
+ * The signer for a provisioned descriptor, verified to actually be that
+ * descriptor's key.
+ *
+ * The verification is a public-key equality, never a wallet-type probe: a
+ * wallet that answers with the wrong key — another seed's, after a restore
+ * mix-up — would sign happily, and the failure would surface only as a
+ * counterparty rejection or a dead script.
+ *
+ * Know its limit. It catches a wallet that substitutes its *baseline*
+ * identity, which is the failure this exists for. It cannot catch one that
+ * returns a descriptor-scoped identity built over the same descriptor, since
+ * such an identity reads its pubkey back out of the descriptor string and the
+ * comparison becomes a tautology. What rules that case out is
+ * {@link resolveDescriptorSigner}'s `isOurs` test, which both shipped wallets
+ * resolve through — so this is the backstop for a hand-rolled `IWallet`, not
+ * the primary guarantee.
+ */
+declare function contractSigner(wallet: IWallet, descriptor: string): Promise<Identity>;
+/**
+ * A wallet that holds a contract's key but cannot sign with it: a watch-only
+ * identity, or a remote signer whose transport is absent.
+ *
+ * Distinct from {@link ForeignDescriptorError} because the remedy differs —
+ * that one says "wrong wallet", this one says "this wallet, without its
+ * signer". Raised at provisioning as well as at signing, so a wallet that
+ * could never spend the leg finds out before it funds one.
+ */
+declare class WalletCannotSignError extends Error {
+    readonly descriptor: string;
+    readonly name = "WalletCannotSignError";
+    constructor(descriptor: string);
 }
 /**
- * Thrown when an input needs descriptor-aware signing but no
- * DescriptorProvider was wired into the wallet.
+ * The preimage for a provisioned descriptor: `stored` when the artifact kept
+ * one, otherwise re-derived from the seed.
+ *
+ * Throws for a descriptor shared across artifacts and no stored preimage —
+ * deriving there would hand two artifacts one preimage, and the caller was
+ * told to persist it (`mustPersistPreimage`).
  */
-declare class DescriptorSigningProviderMissingError extends Error {
-    readonly name = "DescriptorSigningProviderMissingError";
-    constructor();
+declare function contractPreimage(wallet: IWallet, descriptor: string, stored?: Uint8Array): Promise<Uint8Array>;
+/** An identity that signs with `aux_rand = 0`, which is what makes the
+ * derivation reproducible. `DescriptorIdentity` satisfies it, and throws
+ * rather than degrading to a random-aux signer. */
+interface DeterministicSigner extends ReadonlyIdentity {
+    signSchnorrDeterministic(messageHash: Uint8Array): Promise<Uint8Array>;
 }
+declare function isDeterministicSigner(value: unknown): value is DeterministicSigner;
+/**
+ * Claim a restored artifact's index so a later allocation cannot reissue it —
+ * which would derive that artifact's preimage a second time, for a different
+ * one.
+ *
+ * Monotonic, and a no-op wherever there is no index to reserve — a shared-key
+ * descriptor, or another seed's artifact. Restores iterate whole histories, so
+ * an artifact this wallet has nothing to adopt for must not abort the loop.
+ *
+ * Telling "another seed's" apart from a failure needs
+ * {@link HDWalletCapable.signerForDescriptor}, so an allocation-capable wallet
+ * that does not also implement it gets only the watermark call's own untyped
+ * refusal, and a foreign artifact reaches the caller as an error rather than a
+ * skip. Every wallet shipped here implements both.
+ */
+declare function adoptContractDescriptor(wallet: IWallet, descriptor: string): Promise<void>;
 
 type RequestEnvelope = {
     tag: string;
@@ -951,6 +1201,16 @@ type Options = {
      * every (re-)init.
      */
     messageTimeoutOverrides?: Record<string, number>;
+    /**
+     * Optional intent-lifecycle repository, handed to the worker's wallet as
+     * `storage.intentRepository`. Same opt-in as a main-thread wallet: without
+     * it the worker persists no settlement intent, reconciles none on restart,
+     * and counts intent-locked VTXOs as available. Pass the same repository the
+     * main thread uses so both sides read one intent state.
+     *
+     * Ignored when `buildServices` is supplied — that override owns `storage`.
+     */
+    intentRepository?: IntentRepository;
     debug?: boolean;
     buildServices?: (config: Initialize["config"]) => Promise<{
         arkProvider: ArkProvider;
@@ -1015,8 +1275,9 @@ declare class MessageBus {
     private pendingInitCount;
     private readonly buildServicesFn;
     private readonly boundOnMessage;
+    private readonly intentRepository?;
     /** Create the service-worker message bus with repositories and handler configuration. */
-    constructor(walletRepository: WalletRepository, contractRepository: ContractRepository, { messageHandlers, tickIntervalMs, messageTimeoutMs, messageTimeoutOverrides, debug, buildServices, }: Options);
+    constructor(walletRepository: WalletRepository, contractRepository: ContractRepository, { messageHandlers, tickIntervalMs, messageTimeoutMs, messageTimeoutOverrides, intentRepository, debug, buildServices, }: Options);
     /** Start the message bus and attach service-worker event listeners. */
     start(): Promise<void>;
     /** Stop the message bus, cancel ticks, and stop all registered handlers. */
@@ -1804,7 +2065,7 @@ declare class Ramps {
      * @param eventCallback - Optional callback that receives settlement events
      * @returns The Arkade transaction id created by settlement
      * @throws Error if no virtual outputs remain after fee deduction or the destination address cannot be decoded
-     * @see IWallet.getVtxos
+     * @see IWallet.getSpendableVtxos
      * @see IWallet.settle
      * @example
      * ```typescript
@@ -1886,10 +2147,13 @@ declare class HDDescriptorProvider implements DescriptorProvider, ReceiveRotator
      * `getNextSigningDescriptor()` skips indices discovered by a restore
      * scan. Never rewinds: a lower or equal `index` is a no-op.
      *
-     * An invalid `index` (non-integer / negative) is ignored (no-op):
-     * persisting it would corrupt `lastIndexUsed` and make the next
-     * `parseSettings()` throw, mirroring the validation parseSettings
-     * already enforces.
+     * An invalid `index` (non-integer / negative / past the BIP32
+     * non-hardened ceiling) is ignored (no-op): persisting it would corrupt
+     * `lastIndexUsed` and make the next `parseSettings()` throw, mirroring
+     * the validation parseSettings already enforces. The upper bound matters
+     * because the damage outlives the call — `materializeDescriptorAt` cannot
+     * derive at or above 2^31, so a watermark parked there would fail every
+     * subsequent allocation for the life of the repo.
      */
     advanceLastIndexUsed(index: number): Promise<void>;
     /**
@@ -2041,6 +2305,18 @@ type ResponseGetVtxos = ResponseEnvelope & {
         vtxos: Awaited<ReturnType<IWallet["getVtxos"]>>;
     };
 };
+type RequestGetSpendableVtxos = RequestEnvelope & {
+    type: "GET_SPENDABLE_VTXOS";
+    payload: {
+        filter?: GetVtxosFilter;
+    };
+};
+type ResponseGetSpendableVtxos = ResponseEnvelope & {
+    type: "SPENDABLE_VTXOS";
+    payload: {
+        vtxos: Awaited<ReturnType<IWallet["getSpendableVtxos"]>>;
+    };
+};
 type RequestGetBoardingUtxos = RequestEnvelope & {
     type: "GET_BOARDING_UTXOS";
 };
@@ -2225,6 +2501,45 @@ type RequestRefreshOutpoints = RequestEnvelope & {
 type ResponseRefreshOutpoints = ResponseEnvelope & {
     type: "REFRESH_OUTPOINTS_SUCCESS";
 };
+type RequestGetCurrentSigningDescriptor = RequestEnvelope & {
+    type: "GET_CURRENT_SIGNING_DESCRIPTOR";
+};
+type ResponseGetCurrentSigningDescriptor = ResponseEnvelope & {
+    type: "CURRENT_SIGNING_DESCRIPTOR";
+    payload: {
+        descriptor?: string;
+    };
+};
+type RequestGetNextSigningDescriptor = RequestEnvelope & {
+    type: "GET_NEXT_SIGNING_DESCRIPTOR";
+};
+type ResponseGetNextSigningDescriptor = ResponseEnvelope & {
+    type: "NEXT_SIGNING_DESCRIPTOR";
+    payload: {
+        descriptor?: string;
+    };
+};
+type RequestGetUsedSigningDescriptors = RequestEnvelope & {
+    type: "GET_USED_SIGNING_DESCRIPTORS";
+    payload?: {
+        lookAhead?: number;
+    };
+};
+type ResponseGetUsedSigningDescriptors = ResponseEnvelope & {
+    type: "USED_SIGNING_DESCRIPTORS";
+    payload: {
+        descriptors: string[];
+    };
+};
+type RequestAdvanceSigningDescriptorWatermark = RequestEnvelope & {
+    type: "ADVANCE_SIGNING_DESCRIPTOR_WATERMARK";
+    payload: {
+        descriptor: string;
+    };
+};
+type ResponseAdvanceSigningDescriptorWatermark = ResponseEnvelope & {
+    type: "SIGNING_DESCRIPTOR_WATERMARK_ADVANCED";
+};
 type RequestGetAllSpendingPaths = RequestEnvelope & {
     type: "GET_ALL_SPENDING_PATHS";
     payload: {
@@ -2499,8 +2814,8 @@ type RequestRestoreWallet = RequestEnvelope & {
 type ResponseRestoreWallet = ResponseEnvelope & {
     type: "RESTORE_WALLET_SUCCESS";
 };
-type WalletUpdaterRequest = RequestInitWallet | RequestSettle | RequestSendBitcoin | RequestGetAddress | RequestGetBoardingAddress | RequestGetBalance | RequestGetVtxos | RequestGetBoardingUtxos | RequestGetTransactionHistory | RequestGetStatus | RequestGetContractSyncState | RequestClear | RequestReloadWallet | RequestSignTransaction | RequestCreateContract | RequestGetContracts | RequestGetContractsWithVtxos | RequestAnnotateVtxos | RequestUpdateContract | RequestDeleteContract | RequestGetSpendablePaths | RequestGetAllSpendingPaths | RequestIsContractManagerWatching | RequestRefreshVtxos | RequestRefreshOutpoints | RequestSend | RequestGetAssetDetails | RequestIssue | RequestReissue | RequestBurn | RequestDelegate | RequestGetDelegateInfo | RequestRecoverVtxos | RequestGetRecoverableBalance | RequestGetExpiringVtxos | RequestRenewVtxos | RequestGetExpiredBoardingUtxos | RequestSweepExpiredBoardingUtxos | RequestMigrateDeprecatedSignerVtxos | RequestGetDeprecatedSignerStatus | RequestRestoreWallet;
-type WalletUpdaterResponse = ResponseEnvelope & (ResponseInitWallet | ResponseSettle | ResponseSettleEvent | ResponseSendBitcoin | ResponseGetAddress | ResponseGetBoardingAddress | ResponseGetBalance | ResponseGetVtxos | ResponseGetBoardingUtxos | ResponseGetTransactionHistory | ResponseGetStatus | ResponseGetContractSyncState | ResponseClear | ResponseReloadWallet | ResponseUtxoUpdate | ResponseVtxoUpdate | ResponseSignTransaction | ResponseCreateContract | ResponseGetContracts | ResponseGetContractsWithVtxos | ResponseAnnotateVtxos | ResponseUpdateContract | ResponseDeleteContract | ResponseGetSpendablePaths | ResponseGetAllSpendingPaths | ResponseIsContractManagerWatching | ResponseRefreshVtxos | ResponseRefreshOutpoints | ResponseContractEvent | ResponseSend | ResponseGetAssetDetails | ResponseIssue | ResponseReissue | ResponseBurn | ResponseDelegate | ResponseGetDelegateInfo | ResponseRecoverVtxos | ResponseRecoverVtxosEvent | ResponseGetRecoverableBalance | ResponseGetExpiringVtxos | ResponseRenewVtxos | ResponseRenewVtxosEvent | ResponseGetExpiredBoardingUtxos | ResponseSweepExpiredBoardingUtxos | ResponseMigrateDeprecatedSignerVtxos | ResponseMigrateDeprecatedSignerVtxosEvent | ResponseGetDeprecatedSignerStatus | ResponseRestoreWallet);
+type WalletUpdaterRequest = RequestInitWallet | RequestSettle | RequestSendBitcoin | RequestGetAddress | RequestGetBoardingAddress | RequestGetBalance | RequestGetVtxos | RequestGetSpendableVtxos | RequestGetBoardingUtxos | RequestGetTransactionHistory | RequestGetStatus | RequestGetContractSyncState | RequestClear | RequestReloadWallet | RequestSignTransaction | RequestCreateContract | RequestGetContracts | RequestGetContractsWithVtxos | RequestAnnotateVtxos | RequestUpdateContract | RequestDeleteContract | RequestGetSpendablePaths | RequestGetAllSpendingPaths | RequestIsContractManagerWatching | RequestRefreshVtxos | RequestRefreshOutpoints | RequestGetCurrentSigningDescriptor | RequestGetNextSigningDescriptor | RequestGetUsedSigningDescriptors | RequestAdvanceSigningDescriptorWatermark | RequestSend | RequestGetAssetDetails | RequestIssue | RequestReissue | RequestBurn | RequestDelegate | RequestGetDelegateInfo | RequestRecoverVtxos | RequestGetRecoverableBalance | RequestGetExpiringVtxos | RequestRenewVtxos | RequestGetExpiredBoardingUtxos | RequestSweepExpiredBoardingUtxos | RequestMigrateDeprecatedSignerVtxos | RequestGetDeprecatedSignerStatus | RequestRestoreWallet;
+type WalletUpdaterResponse = ResponseEnvelope & (ResponseInitWallet | ResponseSettle | ResponseSettleEvent | ResponseSendBitcoin | ResponseGetAddress | ResponseGetBoardingAddress | ResponseGetBalance | ResponseGetVtxos | ResponseGetSpendableVtxos | ResponseGetBoardingUtxos | ResponseGetTransactionHistory | ResponseGetStatus | ResponseGetContractSyncState | ResponseClear | ResponseReloadWallet | ResponseUtxoUpdate | ResponseVtxoUpdate | ResponseSignTransaction | ResponseCreateContract | ResponseGetContracts | ResponseGetContractsWithVtxos | ResponseAnnotateVtxos | ResponseUpdateContract | ResponseDeleteContract | ResponseGetSpendablePaths | ResponseGetAllSpendingPaths | ResponseIsContractManagerWatching | ResponseRefreshVtxos | ResponseRefreshOutpoints | ResponseGetCurrentSigningDescriptor | ResponseGetNextSigningDescriptor | ResponseGetUsedSigningDescriptors | ResponseAdvanceSigningDescriptorWatermark | ResponseContractEvent | ResponseSend | ResponseGetAssetDetails | ResponseIssue | ResponseReissue | ResponseBurn | ResponseDelegate | ResponseGetDelegateInfo | ResponseRecoverVtxos | ResponseRecoverVtxosEvent | ResponseGetRecoverableBalance | ResponseGetExpiringVtxos | ResponseRenewVtxos | ResponseRenewVtxosEvent | ResponseGetExpiredBoardingUtxos | ResponseSweepExpiredBoardingUtxos | ResponseMigrateDeprecatedSignerVtxos | ResponseMigrateDeprecatedSignerVtxosEvent | ResponseGetDeprecatedSignerStatus | ResponseRestoreWallet);
 declare class WalletMessageHandler implements MessageHandler<WalletUpdaterRequest, WalletUpdaterResponse> {
     readonly messageTag: string;
     private wallet;
@@ -2528,12 +2843,16 @@ declare class WalletMessageHandler implements MessageHandler<WalletUpdaterReques
     isLongRunning(message: WalletUpdaterRequest): boolean;
     handleMessage(message: WalletUpdaterRequest): Promise<WalletUpdaterResponse>;
     private handleInitWallet;
-    private handleGetBalance;
-    private getAllBoardingUtxos;
     /**
-     * Get spendable vtxos from the repository
+     * The worker's own balance. Same bucketing rules as `Wallet.getBalance` —
+     * both call {@link computeOffchainBalance} — but deliberately a different
+     * freshness: this reads the repository directly, with no indexer sync, so a
+     * polling UI never pays for a network round-trip. That rules out
+     * `pendingRecoveryOutpoints()`, whose snapshot syncs; the same classification
+     * runs over this method's local snapshot instead.
      */
-    private getSpendableVtxos;
+    private handleGetBalance;
+    private getAllBoardingUtxos;
     private onWalletInitialized;
     /**
      * Refresh virtual outputs, boarding inputs, and transaction history from cache.
@@ -2551,6 +2870,9 @@ declare class WalletMessageHandler implements MessageHandler<WalletUpdaterReques
     private handleSendBitcoin;
     private handleSignTransaction;
     private handleDelegate;
+    /**
+     * Ungated repository read mirroring `Wallet.getVtxos`, the raw reporting read.
+     */
     private handleGetVtxos;
     /** Tear down handler subscriptions, then delegate the full wipe to the wallet. */
     private clear;
@@ -2559,6 +2881,20 @@ declare class WalletMessageHandler implements MessageHandler<WalletUpdaterReques
      * addresses and the wallet's primary address, with deduplication.
      */
     private getVtxosFromRepo;
+    /**
+     * The worker's equivalent of `ReadonlyWallet.contractSnapshot`: contracts
+     * paired with the VTXOs the repository holds for them, plus the flat
+     * deduplicated list. Purely local — unlike the main-thread snapshot it never
+     * syncs against the indexer.
+     *
+     * One read of the contract rows serves both halves. Reading them twice
+     * (once for the VTXO buckets, once for the gate) races the contract
+     * manager's own writes: a contract registered between the two reads yields
+     * VTXOs with no matching row in the gate, and `gatedContracts` lists only
+     * what it knows is closed — so the coins of a just-registered escrowed
+     * contract would count as available until the next poll.
+     */
+    private repoSnapshot;
     /**
      * Build transaction history from cached virtual outputs, hitting the indexer only for
      * uncached timestamps. Best-effort, like the plain Wallet path.
@@ -2825,6 +3161,18 @@ declare class ServiceWorkerReadonlyWallet implements IReadonlyWallet {
     getActivityHistory(): Promise<Activity[]>;
     getTransactionHistory(): Promise<ArkTransaction[]>;
     getVtxos(filter?: GetVtxosFilter): Promise<NormalizedExtendedVirtualCoin[]>;
+    /**
+     * The gate has to run *inside* the worker (no plugin object or contract row
+     * metadata exists on this side), so this is its own message rather than a
+     * post-filter over `GET_VTXOS`.
+     *
+     * A worker predating this message answers "Unknown message" and the call
+     * throws. That is deliberate: service workers activate asynchronously, so
+     * new page code runs against a stale worker for a window on every deploy,
+     * and falling back to `GET_VTXOS` there would silently spend ungated coins.
+     * Fail closed — loud and recoverable — rather than make the gate advisory.
+     */
+    getSpendableVtxos(filter?: GetVtxosFilter): Promise<NormalizedExtendedVirtualCoin[]>;
     /**
      * Trigger a wallet reload inside the service worker.
      *
@@ -2833,7 +3181,7 @@ declare class ServiceWorkerReadonlyWallet implements IReadonlyWallet {
     reload(): Promise<boolean>;
     getContractManager(): Promise<IContractManager>;
 }
-declare class ServiceWorkerWallet extends ServiceWorkerReadonlyWallet implements IWallet {
+declare class ServiceWorkerWallet extends ServiceWorkerReadonlyWallet implements IWallet, HDWalletCapable, HDAllocationCapable {
     readonly serviceWorker: ServiceWorker;
     readonly walletRepository: WalletRepository;
     readonly contractRepository: ContractRepository;
@@ -2858,6 +3206,33 @@ declare class ServiceWorkerWallet extends ServiceWorkerReadonlyWallet implements
      * ```
      */
     static setup(options: ServiceWorkerWalletSetupOptions): Promise<ServiceWorkerWallet>;
+    /** @see HDWalletCapable.getCurrentSigningDescriptor */
+    getCurrentSigningDescriptor(): Promise<string | undefined>;
+    /** @see HDAllocationCapable.getNextSigningDescriptor */
+    getNextSigningDescriptor(): Promise<string | undefined>;
+    /** @see HDWalletCapable.getUsedSigningDescriptors */
+    getUsedSigningDescriptors(opts?: {
+        lookAhead?: number;
+    }): Promise<string[]>;
+    /** @see HDAllocationCapable.advanceSigningDescriptorWatermark */
+    advanceSigningDescriptorWatermark(descriptor: string): Promise<void>;
+    /**
+     * @see HDWalletCapable.signerForDescriptor
+     *
+     * Runs page-side: an `Identity` cannot cross the message bus, and it does
+     * not need to — the page owns the signing identity, and resolving a
+     * descriptor reads no allocation state. Shares
+     * {@link resolveDescriptorSigner} with {@link Wallet.signerForDescriptor}
+     * so the two sides of the bus cannot answer differently for one
+     * descriptor.
+     *
+     * No provider is passed, and none is needed: `HDDescriptorProvider`'s
+     * `isOurs` and signing members all delegate to the identity, which the
+     * page holds. Building one here would only add a page-side read of the
+     * wallet state the worker allocates from — shared mutable state on a path
+     * that has no business touching it.
+     */
+    signerForDescriptor(descriptor: string): Promise<Identity>;
     sendBitcoin(params: SendBitcoinParams): Promise<string>;
     settle(params?: SettleParams, callback?: (event: SettlementEvent) => void): Promise<string>;
     /**
@@ -3381,6 +3756,20 @@ declare function combineTapscriptSigs(signedTx: Transaction, originalTx: Transac
  * @returns True if the address is valid, false otherwise.
  */
 declare function isValidArkAddress(address: string): boolean;
+/**
+ * Minimal Ark provider surface required to submit and finalize an offchain
+ * transaction. Both {@link ArkProvider} implementations satisfy it
+ * structurally, so declaring it here keeps this module free of a provider
+ * import (and of the dependency cycle that would create).
+ */
+interface OffchainTxSubmitProvider {
+    submitTx(signedArkTx: string, checkpointTxs: string[]): Promise<{
+        arkTxid: string;
+        finalArkTx?: string;
+        signedCheckpointTxs: string[];
+    }>;
+    finalizeTx(arkTxid: string, finalCheckpointTxs: string[]): Promise<void>;
+}
 /**
  * Pair each server-returned checkpoint PSBT with the locally built checkpoint
  * of the same txid, rejecting anything else.
@@ -3420,6 +3809,57 @@ declare function assertSubmittedArkTxid(response: {
     arkTxid: string;
     finalArkTx?: string;
 }, signedArkTx: Transaction, context: string): void;
+/**
+ * Opt-in proof that the server co-signed what it handed back.
+ *
+ * Be precise about what this buys, because it is less than it sounds like. It
+ * does NOT protect a preimage or any other condition value: those reach the
+ * server at `submitTx`, before any of this runs. What it buys is a loud,
+ * immediate failure instead of a caller reporting success, watching nothing
+ * confirm, and learning the truth when the counterparty's refund lands.
+ */
+interface VerifyServerSignatures {
+    /** The Ark server's key; x-only or compressed, both accepted. */
+    serverPubkey: Uint8Array;
+}
+/**
+ * Build, sign, submit, and finalize an offchain transaction whose every input
+ * is controlled by a single key — the "thin signer" path.
+ *
+ * Needs no wallet, repository, or contract state: just an identity that can
+ * sign, an Ark provider, the inputs (already carrying their spend leaf and tap
+ * tree), the outputs, and the server unroll script. Used by the ArkadeCash sweep
+ * to move bearer coins to the receiver's address without spinning up a full
+ * background-managed wallet on shared repositories.
+ *
+ * @returns The Ark transaction id.
+ */
+declare function signAndSubmitOffchainTx(params: {
+    identity: {
+        sign(tx: Transaction, inputIndexes?: number[]): Promise<Transaction>;
+    };
+    provider: OffchainTxSubmitProvider;
+    inputs: ArkTxInput[];
+    outputs: TransactionOutput[];
+    serverUnrollScript: CSVMultisigTapscript.Type;
+    /** Forwarded to {@link submitOffchainTx}; omitted, nothing is checked. */
+    verifyServerSignatures?: VerifyServerSignatures;
+}): Promise<string>;
+/**
+ * Decorate a signer so it reveals `preimage` on every input it signs.
+ *
+ * The ordering encoded here is the whole point: the condition witness is NOT
+ * part of what is signed, so attaching it before signing leaves a signature
+ * over a PSBT that no longer matches once the field is present — which the
+ * server rejects as `INVALID_SIGNATURE`. Decorate per spend, never wallet-wide.
+ *
+ * For any condition-leaf spend (VHTLC claims on both swap directions); the
+ * generic signature keeps the decorated identity's own type, so the result is
+ * still whatever was passed in.
+ */
+declare function claimWithPreimageIdentity<T extends {
+    sign(tx: Transaction, inputIndexes?: number[]): Promise<Transaction>;
+}>(identity: T, preimage: Uint8Array): T;
 
 /**
  * ArkPsbtFieldKey are the available key names for the Arkade PSBT custom fields.
@@ -5566,4 +6006,4 @@ declare class AssetManager extends ReadonlyAssetManager implements IAssetManager
     burn(params: BurnParams): Promise<string>;
 }
 
-export { ARKADE_MAGIC, Activity, ActivityRegistry, AmbiguousRouteError, type AnchorBumper, ArkAddress, ArkIntent, ArkNote, ArkProvider, type ArkPsbtFieldCoder, ArkPsbtFieldKey, ArkPsbtFieldKeyType, ArkTransaction, type ArkTxInput, type ArkadeBatchInput, ArkadeCash, ArkadeContractParams, type ArkadeExtendedCoin, type ArkadeExtendedVirtualCoin, Asset, AssetDetails, AssetManager, BIP21, BIP21Error, type BIP21Params, type BIP21ParseResult, BIP322, Batch, BatchExpiryPolicy, BurnParams, CSVMultisigTapscript, ChainTx, Coin, ConditionWitness, type ConnectorTreeNode, Contract, ContractEvent, ContractRepository, ContractRepositoryImpl, ContractSyncState, ContractWatcherConfig, ContractWithVtxos, CosignerPublicKey, CreateContractParams, DEFAULT_MESSAGE_TIMEOUTS, DefaultVtxo, DelegateInfo, DelegateNotConfiguredError, DelegatorNotConfiguredError, DescriptorIdentity, type DescriptorIdentityOptions, type DescriptorOptions, type DescriptorSigner, DescriptorSigningProviderMissingError, DustChangeError, ELECTRUM_TCP_HOST, ELECTRUM_WS_URL, type BlockHeader as ElectrumBlockHeader, ElectrumOnchainProvider, type TransactionHistory as ElectrumTransactionHistory, type Unspent as ElectrumUnspent, type EmulatorEntry, type EmulatorInfo, EmulatorPacket, type EmulatorProvider, EncodedVtxoScript, Estimator, type ExecutorEvent, type ExitDelay, type ExitFeeWallet, type ExitMode, type ExitOptions, type ExitPackage, type ExitQuote, type ExitStep, type ExitTotals, type ExitVtxoInfo, ExplorerTransaction, ExtendedCoin, ExtendedVirtualCoin, Extension, ExtensionNotFoundError, type ExtensionPacket, FeeAmount, FeeInfo, FeeOutput, FetchError, GetVtxosFilter, HDDescriptorProvider, type HDDeterministicSignCapable, IAssetManager, IContractManager, IDelegateManager, IReadonlyAssetManager, IReadonlyWallet, IVtxoManager, IWallet, Identity, InMemoryContractRepository, InMemoryIntentRepository, InMemoryVirtualTxRepository, InMemoryWalletRepository, IndexedDBContractRepository, IndexedDBIntentRepository, IndexedDBVirtualTxRepository, IndexedDBWalletRepository, IndexerProvider, Intent, IntentFeeConfig, IntentFilter, IntentRepository, IssuanceParams, IssuanceResult, MESSAGE_BUS_INITIALIZING, MESSAGE_BUS_NOT_INITIALIZED, MIGRATION_KEY, MessageBus, MessageBusInitializingError, MessageBusNotInitializedError, type MessageHandler, type MessageTimeouts, MigrationGlobalSkipReason, MigrationLegSkipReason, type MigrationStatus, MissingSigningDescriptorError, MnemonicIdentity, type MnemonicOptions, Network, NetworkName, type NetworkOptions, OffchainInput, type OffchainTx, OnchainInput, OnchainProvider, OnchainWallet, Outpoint, P2A, type ParsedArkContract, PathContext, PathSelection, type PaymentHandle, type PaymentOption, type PaymentRail, type PaymentRequest, PaymentRouter, type PaymentStatus, PrevArkTxField, PrevoutTxField, ProviderConnectionState, Ramps, ReadonlyAssetManager, ReadonlyDescriptorIdentity, ReadonlyIdentity, ReadonlySingleKey, ReadonlyWallet, ReadonlyWalletError, Recipient, ReissuanceParams, RelativeTimelock, RenewVtxosOptions, type RequestEnvelope, type ResponseEnvelope, RestEmulatorProvider, type RouteQuote, type RouteResult, type RouterContext, type RouterPreferences, SeedIdentity, type SeedIdentityOptions, SendBitcoinParams, ServiceWorkerReadonlyWallet, ServiceWorkerTimeoutError, ServiceWorkerWallet, type ServiceWorkerWalletMode, SettleParams, SettlementConfig, SettlementEvent, SignerSession, SignerStatus, SingleKey, Status, StorageConfig, TapLeafScript, Transaction, TxTree, TxWeightEstimator, UnilateralExit, UnknownPacket, Unroll, type VSize, VirtualCoin, VirtualTx, VirtualTxRepository, VtxoBranch, VtxoScript, VtxoTaprootTree, VtxoTreeExpiry, Wallet, WalletBalance, WalletMessageHandler, WalletNotInitializedError, WalletRepository, WalletRepositoryImpl, WsElectrumChainSource, arkRail, arkTarget, index as arkade, assembleBtcdTaprootTree, assertFinalCommitmentMatchesValidated, assertSendableAmount, assertSubmittedArkTxid, index$1 as asset, btcTarget, buildForfeitTx, buildOffchainTx, buildVersion, closeDatabase, combineTapscriptSigs, contractFromArkContract, contractFromArkContractWithAddress, createAssetPacket, createDefaultPaymentRouter, decodeArkContract, deriveDescriptorLeafCompressedPubKey, deserializeExitPackage, encodeArkContract, getArkPsbtFields, getMigrationStatus, hasBoardingTxExpired, invoiceTarget, isArkContract, isBtcAddress, isCltvSatisfied, isCsvSpendable, isHDDeterministicSignCapable, isLightningInvoice, isLnurl, isMessageBusInitializingError, isMessageBusNotInitializedError, isRetryableProviderError, isValidArkAddress, makeHandle, matchServerCheckpoints, migrateWalletRepository, onchainRail, openDatabase, requiresMigration, resolveSendAmount, rollbackMigration, sdkVersion, selectCoinsWithAsset, sequenceToTimelock, serializeExitPackage, setArkPsbtField, setupServiceWorker, timelockToSequence, tryResolveSendAmount, validateBatchRecipients, validateConnectorsTxGraph, validateVtxoTxGraph, verifyTapscriptSignatures };
+export { ARKADE_MAGIC, ARKADE_SWAP_PREIMAGE_TAG, Activity, ActivityRegistry, AmbiguousRouteError, type AnchorBumper, ArkAddress, ArkIntent, ArkNote, ArkProvider, type ArkPsbtFieldCoder, ArkPsbtFieldKey, ArkPsbtFieldKeyType, ArkTransaction, type ArkTxInput, type ArkadeBatchInput, ArkadeCash, ArkadeContractParams, type ArkadeExtendedCoin, type ArkadeExtendedVirtualCoin, Asset, AssetDetails, AssetManager, BIP21, BIP21Error, type BIP21Params, type BIP21ParseResult, BIP322, Batch, BatchExpiryPolicy, BurnParams, CSVMultisigTapscript, ChainTx, Coin, ConditionWitness, type ConnectorTreeNode, Contract, ContractEvent, ContractRepository, ContractRepositoryImpl, ContractSyncState, ContractWatcherConfig, ContractWithVtxos, CosignerPublicKey, CreateContractParams, DEFAULT_MESSAGE_TIMEOUTS, DefaultVtxo, DelegateInfo, DelegateNotConfiguredError, DelegatorNotConfiguredError, DescriptorIdentity, type DescriptorIdentityOptions, type DescriptorOptions, type DescriptorSigner, DescriptorSigningProviderMissingError, type DeterministicSigner, DustChangeError, ELECTRUM_TCP_HOST, ELECTRUM_WS_URL, type BlockHeader as ElectrumBlockHeader, ElectrumOnchainProvider, type TransactionHistory as ElectrumTransactionHistory, type Unspent as ElectrumUnspent, type EmulatorEntry, type EmulatorInfo, EmulatorPacket, type EmulatorProvider, EncodedVtxoScript, Estimator, type ExcludableVtxo, type ExecutorEvent, type ExitDelay, type ExitFeeWallet, type ExitMode, type ExitOptions, type ExitPackage, type ExitQuote, type ExitStep, type ExitTotals, type ExitVtxoInfo, ExplorerTransaction, ExtendedCoin, ExtendedVirtualCoin, Extension, ExtensionNotFoundError, type ExtensionPacket, FeeAmount, FeeInfo, FeeOutput, FetchError, GetVtxosFilter, HDAllocationCapable, HDDescriptorProvider, type HDDeterministicSignCapable, HDWalletCapable, IAssetManager, IContractManager, IDelegateManager, IReadonlyAssetManager, IReadonlyWallet, IVtxoManager, IWallet, Identity, InMemoryContractRepository, InMemoryIntentRepository, InMemoryVirtualTxRepository, InMemoryWalletRepository, IndexedDBContractRepository, IndexedDBIntentRepository, IndexedDBVirtualTxRepository, IndexedDBWalletRepository, IndexerProvider, Intent, IntentFeeConfig, IntentFilter, IntentRepository, IssuanceParams, IssuanceResult, MESSAGE_BUS_INITIALIZING, MESSAGE_BUS_NOT_INITIALIZED, MIGRATION_KEY, MessageBus, MessageBusInitializingError, MessageBusNotInitializedError, type MessageHandler, type MessageTimeouts, MigrationGlobalSkipReason, MigrationLegSkipReason, type MigrationStatus, MissingSigningDescriptorError, MnemonicIdentity, type MnemonicOptions, Network, NetworkName, type NetworkOptions, OffchainInput, type OffchainTx, OnchainInput, OnchainProvider, OnchainWallet, Outpoint, P2A, type ParsedArkContract, PathContext, PathSelection, type PaymentHandle, type PaymentOption, type PaymentRail, type PaymentRequest, PaymentRouter, type PaymentStatus, PrevArkTxField, PrevoutTxField, ProviderConnectionState, type ProvisionedClaimSecret, type ProvisionedKey, Ramps, ReadonlyAssetManager, ReadonlyDescriptorIdentity, ReadonlyIdentity, ReadonlySingleKey, ReadonlyWallet, ReadonlyWalletError, Recipient, ReissuanceParams, RelativeTimelock, RenewVtxosOptions, type RequestEnvelope, type ResponseEnvelope, RestEmulatorProvider, type RouteQuote, type RouteResult, type RouterContext, type RouterPreferences, SeedIdentity, type SeedIdentityOptions, SendBitcoinParams, ServiceWorkerReadonlyWallet, ServiceWorkerTimeoutError, ServiceWorkerWallet, type ServiceWorkerWalletMode, SettleParams, SettlementConfig, SettlementEvent, SignerSession, SignerStatus, SingleKey, Status, StorageConfig, TapLeafScript, Transaction, TxTree, TxWeightEstimator, UnannotatableInputError, UnilateralExit, UnknownPacket, Unroll, type VSize, type VerifyServerSignatures, VirtualCoin, VirtualTx, VirtualTxRepository, VtxoBranch, type VtxoExclusion, VtxoScript, VtxoTaprootTree, VtxoTreeExpiry, Wallet, WalletBalance, WalletCannotSignError, WalletMessageHandler, WalletNotInitializedError, WalletRepository, WalletRepositoryImpl, WsElectrumChainSource, adoptContractDescriptor, arkRail, arkTarget, index as arkade, assembleBtcdTaprootTree, assertFinalCommitmentMatchesValidated, assertSendableAmount, assertSubmittedArkTxid, index$1 as asset, btcTarget, buildForfeitTx, buildOffchainTx, buildPreimageMessage, buildVersion, claimWithPreimageIdentity, closeDatabase, combineTapscriptSigs, contractFromArkContract, contractFromArkContractWithAddress, contractPreimage, contractSigner, createAssetPacket, createDefaultPaymentRouter, decodeArkContract, deriveDescriptorLeafCompressedPubKey, deriveDescriptorLeafPubKey, deserializeExitPackage, encodeArkContract, gateExclusion, gatedContracts, getArkPsbtFields, getMigrationStatus, hasBoardingTxExpired, identityDescriptor, invoiceTarget, isArkContract, isBtcAddress, isCltvSatisfied, isContractGenericallySpendable, isCsvSpendable, isDeterministicSigner, isHDDeterministicSignCapable, isLightningInvoice, isLnurl, isMessageBusInitializingError, isMessageBusNotInitializedError, isPerArtifactDescriptor, isRetryableProviderError, isValidArkAddress, logExcludedVtxos, makeHandle, matchServerCheckpoints, migrateWalletRepository, normalizeToDescriptor, onchainRail, openDatabase, outpointExclusion, outpointReasons, parseHDDescriptor, provisionClaimSecret, provisionRefundKey, requiresMigration, resolveSendAmount, rollbackMigration, sdkVersion, selectCoinsWithAsset, sequenceToTimelock, serializeExitPackage, setArkPsbtField, setupServiceWorker, signAndSubmitOffchainTx, timelockToSequence, tryResolveSendAmount, validateBatchRecipients, validateConnectorsTxGraph, validateVtxoTxGraph, verifyTapscriptSignatures };